Agentic bid workflows: where an agent helps and where a person signs
An agent that drafts, checks and assembles bid material is only useful if every step can be verified, and a bid is a legal commitment that a named person signs. We are studying where autonomy helps and where it must stop. This is active work and it is not shipped.
A submission is a promise
Preparing a bid is mostly assembly. A team collects past project references, reuses method statements, answers the same compliance questions in a new buyer format, fills forms and checks the whole pack against the tender requirements before a deadline. Much of it is repetitive and a lot of it is checking, which makes it look like a natural job for an agent.
It is also a job where mistakes are expensive. A submitted bid is an offer. Statements in it become representations the firm can be held to, and some are made under declarations a director signs. We are studying agentic workflows for this problem. To be clear about status, this is active work and it is not shipped: Klarum does not offer an agent that prepares bids today, and nothing here describes something a customer can use.
Method
We start from a constraint rather than a capability: every action an agent takes on bid material must leave a record a person can inspect, and every claim it places in a draft must point at the source it came from. Retrieval-backed systems carry known weaknesses in how they store and fetch the material they draw on[1], so an agent that produces fluent text with no trail is worse than useless here: fluent text is exactly what makes a wrong statement easy to miss.
From that constraint we divide the work by how reversible and how consequential each step is. Steps that only read and organise are cheap to get wrong and cheap to undo. Steps that assert something about the firm, or commit it, are the opposite. The line between them is where we think a person must take over.
| Task | Agent role | Person role |
|---|---|---|
| Find relevant past references | Proposes candidates with sources | Chooses which to use |
| Check a draft against tender requirements | Flags gaps and mismatches | Decides what a flag means |
| Reformat answers to a buyer template | Does the mechanical work | Reviews the result |
| Draft a method statement | Produces a cited first draft | Rewrites and owns every claim |
| State a price or a commitment | Nothing beyond surfacing inputs | Decides and writes it |
| Sign and submit | Nothing | Does it, personally |
Verifiability before autonomy
We would rather build the checking than the drafting. A checker that compares a draft to the tender, confirms that every cited reference exists and says what it says, and notices a requirement left unanswered, is something a reviewer can rely on without trusting the drafter. Drafting without that check only moves the risk from the writing stage to the review stage, where people are tired and a deadline is close.
Discussion
Limitations
We do not yet know how well an agent can be verified. Checking that a quotation matches its source is tractable. Checking that a claim is true of the firm, or that an answer is responsive in the way an evaluator will read it, is not, and we have no measurement to offer. An agent can be confidently wrong in a way that passes every mechanical check, so a clean automated check must never be presented as assurance.
There is also a quieter risk: attention. If an agent is right most of the time, reviewers learn to skim, and the occasional error arrives exactly when nobody is looking. A workflow that lowers the effort of review can lower the quality of review. We take that as a design problem to be studied, not a detail to be tuned later.
Confidentiality is a third limit. Bid material contains pricing, staff details and client names. Where that material goes, and what is retained, is a question a procurement buyer is right to ask first, and we are not claiming an answer here.
Why the human holds the pen
Autonomy helps where the cost of an error is low and the output can be checked: finding, sorting, reformatting, flagging. It stops helping at the point where the text becomes a representation of the firm. A bid says that the firm has done this work, will staff it this way and will deliver at this price. Someone with authority has to be willing to stand behind each of those sentences, and a person cannot stand behind words they did not choose and did not read.
That is a legal point and a practical one. When a representation turns out to be false, the question asked afterwards is who made it, and the answer cannot be an agent. We therefore treat the signature as the end of the automated path by design. Whatever an agent prepares, a named person reviews it, changes it where it is wrong, and signs it.
Next steps
We want to study which checks catch real errors in real submissions, how reviewers behave when an agent has already done a pass, and how to record an agent trail that an auditor or a buyer could follow. We are not committing to a result or a timetable.
Conclusion
An agent can take the tedious, checkable parts of a bid off a team, provided each step is traceable and a person remains responsible for what is asserted. We have a position on where that boundary sits and a list of things we do not yet know. We do not have a shipped product to point to, and we would rather say so than imply one.
References
- [1]LLM08:2025 Vector and Embedding Weaknesses. OWASP Top 10 for LLM Applications. Why an embedding is treated as personal data here: inversion back to source text is a catalogued attack class, not a hypothetical.